Email: 523560 Autolearn: 0 AvgScore: 3.62 AvgScanTime: 1.41 sec Spam: 164785 Autolearn: 0 AvgScore: 13.29 AvgScanTime: 1.50 sec Ham: 358775 Autolearn: 0 AvgScore: -0.83 AvgScanTime: 1.36 sec Time Spent Running SA: 204.57 hours Time Spent Processing Spam: 68.78 hours Time Spent Processing Ham: 135.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156563 89.60 95.01 87.11 2 DKIM_SIGNED 145911 79.60 88.55 75.49 3 XM_DK_Pass 143310 77.79 86.97 73.58 4 DKIM_VALID 142151 76.86 86.26 72.54 5 XM_B_Unicode 136372 74.55 82.76 70.77 6 RELAYCOUNTRY_US 133459 80.82 80.99 80.74 7 XMListUnsubscribeExists 118418 56.96 71.86 50.12 8 XM_B_SpammyWords 116593 53.81 70.75 46.02 9 DCC_CHECK 112570 44.79 68.31 33.99 10 DKIM_VALID_AU 111957 61.15 67.94 58.03 11 RCVD_IN_MSPIKE_H2 79511 42.48 48.25 39.82 12 XM_B_Unicode3 74183 42.42 45.02 41.23 13 BAYES_50 70698 54.16 42.90 59.33 14 XM_DK_Undo_02 69716 17.71 42.31 6.41 15 XM_B_SpammyWords2 65453 25.33 39.72 18.72 16 LOC_TINY_FONT_1 61557 29.52 37.36 25.92 17 FVGT_m_MULTI_ODD 59198 29.28 35.92 26.22 18 HTML_FONT_LOW_CONTRAST 57364 30.19 34.81 28.07 19 TR_XM_DKIM_Undo 55208 13.78 33.50 4.71 20 BAYES_99 54460 13.83 33.05 5.01 21 DKIM_VALID_EF 54445 29.90 33.04 28.46 22 MIME_HTML_ONLY 53036 24.27 32.18 20.63 23 DCC_CHECK_NEGATIVE 52181 55.17 31.67 65.96 24 T_KAM_HTML_FONT_INVALID 51436 23.53 31.21 20.00 25 BAYES_999 42400 10.79 25.73 3.92 26 XMSubLong 39690 23.13 24.09 22.69 27 TR_DCC_Bayes_99 38646 8.55 23.45 1.70 28 XM_Body_Dirty_Words 37849 15.29 22.97 11.76 29 T_TM2_M_HEADER_IN_MSG 37408 27.84 22.70 30.19 30 RELAYCOUNTRY_META 34653 9.24 21.03 3.82 31 XM_Multi_Part_URI 32549 15.45 19.75 13.48 32 TR_XM_SpammyRelay 25013 5.97 15.18 1.73 33 XM_B_Unsub 24972 10.59 15.15 8.50 34 RCVD_IN_MSPIKE_WL 24968 17.13 15.15 18.05 35 TR_XM_BayesUnsub 24386 9.54 14.80 7.12 36 LOTS_OF_MONEY 21821 8.41 13.24 6.19 37 BOTNET_IPINHOSTNAME 20853 7.25 12.65 4.77 38 XM_B_SpammyWords3 20562 6.68 12.48 4.01 39 RCVD_IN_MSPIKE_H3 20550 12.35 12.47 12.30 40 TR_XM_SpammyWords2 19234 4.33 11.67 0.96 41 TR_XM_SpammyWords4 19149 6.36 11.62 3.95 42 UNPARSEABLE_RELAY 17692 9.22 10.74 8.53 43 XM_Evil_Numbers_Gen 16834 9.24 10.22 8.79 44 XMSexyCombo_05 16756 5.91 10.17 3.95 45 XM_UncommonTLD01 15755 5.69 9.56 3.91 46 FSL_BULK_SIG 15161 5.07 9.20 3.18 47 MPART_ALT_DIFF 15075 6.58 9.15 5.40 48 RELAYCOUNTRY_CA 14689 3.43 8.91 0.92 49 BOTNET 14490 3.88 8.79 1.63 50 RCVD_IN_BL_SPAMCOP_NET 13775 2.90 8.36 0.40 51 BAYES_80 13262 5.48 8.05 4.30 52 BAYES_60 13147 8.70 7.98 9.03 53 UNTRUSTED_Relay 13035 3.54 7.91 1.53 54 TR_XM_PhishingBody 11743 4.82 7.13 3.76 55 LotsOfNums_01 11678 7.82 7.09 8.15 56 TR_XM_UnparsRelay 10536 2.97 6.39 1.40 57 HTML_IMAGE_RATIO_02 10500 5.72 6.37 5.41 58 XMSubMetaSx_00 10245 4.47 6.22 3.67 59 MIME_HTML_ONLY_MULTI 10127 4.26 6.15 3.39 60 XM_SendGrid 10059 5.74 6.10 5.58 61 TM2_M_VERY_LONG_WORD 10001 3.22 6.07 1.92 62 TR_XM_SPAMCOP 9503 1.94 5.77 0.18 63 XM_B_Phish_Phrases 9467 3.96 5.75 3.14 64 XM_H_Long_From01 9273 5.43 5.63 5.34 65 TooManyTo_001 9148 7.83 5.55 8.87 66 XMStrtUSub 8498 4.75 5.16 4.56 67 XM_B_Investor 8150 2.65 4.95 1.60 68 HTML_IMAGE_RATIO_04 8134 4.80 4.94 4.74 69 HTML_MIME_NO_HTML_TAG 8011 3.18 4.86 2.40 70 BAYES_95 7407 3.29 4.49 2.73 71 XM_SPF_SoftFail 7321 3.13 4.44 2.53 72 MIME_HTML_MOSTLY 7153 3.26 4.34 2.76 73 TR_XM_SpammyWords5 6733 2.15 4.09 1.26 74 TR_XM_DK_SendGrid 6732 3.88 4.09 3.79 75 XM_DIRTYINTL 6667 1.51 4.05 0.35 76 SpammyFromTLD_02 6552 1.54 3.98 0.43 77 T_XMDrugObfuBody_08 6486 2.67 3.94 2.09 78 XMNumbers 6477 3.84 3.93 3.79 79 XM_GoogleGroups 6451 2.63 3.91 2.04 80 XM_B_SpammyTLD 6426 2.76 3.90 2.24 81 T_FILL_THIS_FORM_SHORT 6329 2.04 3.84 1.21 82 XM_OfRef6 6274 1.95 3.81 1.10 83 HTML_IMAGE_RATIO_06 6167 4.11 3.74 4.28 84 XM_B_Phish66 6108 2.37 3.71 1.76 85 XMLngstWrd_00 6085 2.01 3.69 1.24 86 XMLngstWrd_01 6002 1.94 3.64 1.16 87 XMBody_17 5994 1.50 3.64 0.51 88 XM_UB50 5981 1.84 3.63 1.02 89 XMLngstWrd_02 5886 1.85 3.57 1.05 90 T_XMDrugObfuBody_14 5830 2.19 3.54 1.58 91 MIME_QP_LONG_LINE 5762 4.46 3.50 4.90 92 XMLngstWrd_03 5739 1.75 3.48 0.96 93 XMLngstWrd_04 5587 1.67 3.39 0.88 94 HTML_TITLE_SUBJ_DIFF 5486 1.52 3.33 0.70 95 UPPERCASE_75_100 5376 1.50 3.26 0.69 96 RCVD_IN_MSPIKE_BL 5075 1.41 3.08 0.64 97 TR_XM_MSPIKECOMBO 5034 1.39 3.05 0.62 98 XMDiploma_00 5025 2.02 3.05 1.55 99 HTML_IMAGE_RATIO_08 4948 2.85 3.00 2.78 100 XM_B_Unsub2 4866 2.05 2.95 1.63 101 XM_B_SpammyWords4 4561 1.44 2.77 0.83 102 TM2_M_URI_OPT_OUT 4547 2.10 2.76 1.79 103 RCVD_IN_VALIDITY_SAFE 4344 4.26 2.64 5.01 104 TR_XM_NoHeaderRelay 4206 0.88 2.55 0.12 105 RCVD_IN_MSPIKE_H4 4136 4.02 2.51 4.72 106 XM_CamelCaseFrm001 4085 2.03 2.48 1.83 107 URI_NOVOWEL 4013 2.51 2.44 2.55 108 SpammyFromTLD_01 3980 1.33 2.42 0.83 109 RCVD_IN_MSPIKE_L3 3961 1.14 2.40 0.56 110 HK_RANDOM_REPLYTO 3888 0.79 2.36 0.08 111 FROM_EXCESS_BASE64 3831 2.57 2.32 2.69 112 USER_IN_DEF_DKIM_WL 3825 9.71 2.32 13.10 113 DKIM_INVALID 3760 2.74 2.28 2.95 114 T_TooManySym_01 3714 5.12 2.25 6.43 115 TR_XM_FormFill 3683 0.71 2.24 0.01 116 RCVD_IN_IADB_LISTED 3680 4.21 2.23 5.11 117 RCVD_IN_VALIDITY_CERTIFIED 3608 3.78 2.19 4.51 118 T_REMOTE_IMAGE 3593 3.22 2.18 3.70 119 FONT_INVIS_LONG_LINE 3523 0.73 2.14 0.08 120 TR_XM_SpammyWords3 3475 0.86 2.11 0.29 121 XM_DK_Undo_01 3423 1.76 2.08 1.62 122 SUBJ_ALL_CAPS 3373 1.80 2.05 1.68 123 TR_LOTS_OF_MONEY3 3304 0.86 2.01 0.33 124 ALL_TRUSTED 3283 11.84 1.99 16.37 125 RCVD_IN_IADB_SPF 3271 3.71 1.99 4.51 126 MAILING_LIST_MULTI 3134 2.47 1.90 2.73 127 XMSexyCombo_01 3119 1.01 1.89 0.61 128 RCVD_IN_IADB_DK 3100 3.28 1.88 3.92 129 RCVD_IN_IADB_SENDERID 3031 3.35 1.84 4.04 130 T_XMHurry_00 2952 0.88 1.79 0.47 131 TR_XM_SB_Phish 2928 2.02 1.78 2.13 132 URI_HEX 2906 1.37 1.76 1.18 133 URIBL_DBL_SPAM 2879 0.55 1.75 0.01 134 TR_Mismatch_TLD_02 2878 0.62 1.75 0.10 135 XM_URI_RBL 2852 0.65 1.73 0.16 136 KHOP_HELO_FCRDNS 2724 1.57 1.65 1.53 137 XMStockSpam_06 2718 1.36 1.65 1.23 138 XMSubPhish11 2711 1.96 1.65 2.11 139 XMGenDplmaNmb 2679 0.99 1.63 0.70 140 HTML_TAG_BALANCE_BODY 2589 0.96 1.57 0.68 141 T_XMDrugObfuBody_00 2578 0.95 1.56 0.67 142 URIBL_BLACK 2533 0.52 1.54 0.05 143 XMHTML_After_End 2519 1.04 1.53 0.82 144 XMBdyGiftCard01 2461 0.95 1.49 0.70 145 FROM_SUSPICIOUS_NTLD 2459 0.51 1.49 0.06 146 TR_XM_PHPDW 2439 0.77 1.48 0.44 147 XM_UB60 2416 0.55 1.47 0.13 148 XMBrknScrpt_02 2404 1.11 1.46 0.94 149 XMPhish14 2401 0.88 1.46 0.62 150 BAYES_40 2375 3.64 1.44 4.65 151 TR_XM_PHPForged 2330 0.71 1.41 0.39 152 XM_B_COVIDMETA 2316 0.76 1.41 0.47 153 TR_XM_FormFill2 2275 0.70 1.38 0.39 154 XM_H_PHPOS 2274 0.70 1.38 0.38 155 REMOVE_BEFORE_LINK 2255 0.64 1.37 0.30 156 RELAYCOUNTRY_IN 2253 0.63 1.37 0.29 157 LongTLD 2195 0.59 1.33 0.25 158 TR_XM_BayesRelay 2184 0.42 1.33 0.00 159 RELAYCOUNTRY_AU 2146 0.61 1.30 0.29 160 TR_Symld_Words 2108 1.49 1.28 1.59 161 XM_UB99 2082 0.40 1.26 0.00 162 FROM_SUSPICIOUS_NTLD_FP 2056 0.43 1.25 0.05 163 RCVD_IN_VALIDITY_RPBL 2051 0.45 1.24 0.08 164 XM_H_Long_From02 2042 1.24 1.24 1.25 165 XM_H_Undi_Recip 2025 0.55 1.23 0.24 166 DIET_1 1907 0.56 1.16 0.29 167 RELAYCOUNTRY_DE 1866 0.56 1.13 0.29 168 XMPhish30 1827 1.05 1.11 1.02 169 XM_Body_Dirty_Words_01 1826 0.44 1.11 0.14 170 MPART_ALT_DIFF_COUNT 1820 0.70 1.10 0.51 171 TR_XM_Base64_M1 1813 1.12 1.10 1.12 172 TR_XM_RelayPhish 1806 0.39 1.10 0.06 173 URI_TRY_3LD 1799 0.75 1.09 0.59 174 RCVD_IN_PSBL 1773 0.56 1.08 0.32 175 XMReplyNow 1744 0.50 1.06 0.24 176 BOTNET_NORDNS 1734 0.34 1.05 0.02 177 PDS_OTHER_BAD_TLD 1706 0.50 1.04 0.26 178 XM_UB999 1700 0.33 1.03 0.00 179 HTTPS_HTTP_MISMATCH 1695 0.96 1.03 0.93 180 XM_ProductURIs 1693 0.69 1.03 0.54 181 XM_B_SEO 1690 0.45 1.03 0.18 182 XMBody_29 1687 0.36 1.02 0.05 183 RCVD_IN_IADB_VOUCHED 1676 2.57 1.02 3.28 184 XMMoneyMeta_00 1669 0.66 1.01 0.50 185 TR_XM_MSPIKECOMBO2 1667 0.33 1.01 0.02 186 BAYES_20 1667 2.69 1.01 3.45 187 TR_XM_InvalidRelay 1660 0.33 1.01 0.01 188 XM_Combo_Sbj 1641 0.44 1.00 0.18 189 TR_XM_SEO4 1566 0.38 0.95 0.12 190 RELAYCOUNTRY_FR 1544 0.44 0.94 0.21 191 SHOPIFY_IMG_NOT_RCVD_SFY 1542 0.46 0.94 0.24 192 T_MONEY_PERCENT 1538 0.41 0.93 0.18 193 TR_LOTS_OF_MONEY2 1538 0.41 0.93 0.18 194 RELAYCOUNTRY_NL 1537 0.39 0.93 0.13 195 TM2_M_A_HREF_HREF 1399 0.42 0.85 0.22 196 RELAYCOUNTRY_IE 1393 0.45 0.85 0.28 197 URI_PHP_REDIR 1386 0.27 0.84 0.00 198 RELAYCOUNTRY_RU 1371 0.28 0.83 0.02 199 HTML_IMAGE_ONLY_16 1353 0.46 0.82 0.30 200 TR_XM_COVIDMETA4 1339 0.37 0.81 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 312541 89.60 95.01 87.11 2 RELAYCOUNTRY_US 289678 80.82 80.99 80.74 3 DKIM_SIGNED 270838 79.60 88.55 75.49 4 XM_DK_Pass 263979 77.79 86.97 73.58 5 DKIM_VALID 260259 76.86 86.26 72.54 6 XM_B_Unicode 253921 74.55 82.76 70.77 7 DCC_CHECK_NEGATIVE 236659 55.17 31.67 65.96 8 BAYES_50 212861 54.16 42.90 59.33 9 DKIM_VALID_AU 208191 61.15 67.94 58.03 10 XMListUnsubscribeExists 179810 56.96 71.86 50.12 11 XM_B_SpammyWords 165118 53.81 70.75 46.02 12 XM_B_Unicode3 147917 42.42 45.02 41.23 13 RCVD_IN_MSPIKE_H2 142877 42.48 48.25 39.82 14 DCC_CHECK 121934 44.79 68.31 33.99 15 T_TM2_M_HEADER_IN_MSG 108325 27.84 22.70 30.19 16 DKIM_VALID_EF 102093 29.90 33.04 28.46 17 HTML_FONT_LOW_CONTRAST 100703 30.19 34.81 28.07 18 FVGT_m_MULTI_ODD 94084 29.28 35.92 26.22 19 LOC_TINY_FONT_1 92987 29.52 37.36 25.92 20 XMSubLong 81421 23.13 24.09 22.69 21 MIME_HTML_ONLY 74013 24.27 32.18 20.63 22 T_KAM_HTML_FONT_INVALID 71753 23.53 31.21 20.00 23 XM_B_SpammyWords2 67170 25.33 39.72 18.72 24 RCVD_IN_MSPIKE_WL 64743 17.13 15.15 18.05 25 ALL_TRUSTED 58730 11.84 1.99 16.37 26 XM_Multi_Part_URI 48361 15.45 19.75 13.48 27 USER_IN_DEF_DKIM_WL 46993 9.71 2.32 13.10 28 RCVD_IN_MSPIKE_H3 44116 12.35 12.47 12.30 29 XM_Body_Dirty_Words 42192 15.29 22.97 11.76 30 BAYES_00 33812 6.64 0.59 9.42 31 XM_DKIMWhitelistDomains 33527 6.41 0.02 9.34 32 BAYES_60 32391 8.70 7.98 9.03 33 TooManyTo_001 31828 7.83 5.55 8.87 34 XM_Evil_Numbers_Gen 31546 9.24 10.22 8.79 35 UNPARSEABLE_RELAY 30595 9.22 10.74 8.53 36 XM_B_Unsub 30491 10.59 15.15 8.50 37 LotsOfNums_01 29255 7.82 7.09 8.15 38 TR_XM_BayesUnsub 25562 9.54 14.80 7.12 39 T_TooManySym_01 23081 5.12 2.25 6.43 40 IN_ZIMBRA_NJ_WHITELIST 23024 4.42 0.08 6.42 41 XM_DK_Undo_02 23000 17.71 42.31 6.41 42 LOTS_OF_MONEY 22221 8.41 13.24 6.19 43 TR_XM_DK_Bayes 21371 4.21 0.41 5.96 44 TR_XM_DK_Bayes1 20970 4.13 0.40 5.84 45 XM_SendGrid 20008 5.74 6.10 5.58 46 HTML_IMAGE_RATIO_02 19424 5.72 6.37 5.41 47 MPART_ALT_DIFF 19365 6.58 9.15 5.40 48 XM_H_Long_From01 19147 5.43 5.63 5.34 49 TR_XM_DK_Bayes2 18612 3.67 0.38 5.19 50 RCVD_IN_IADB_LISTED 18351 4.21 2.23 5.11 51 BAYES_99 17968 13.83 33.05 5.01 52 RCVD_IN_VALIDITY_SAFE 17968 4.26 2.64 5.01 53 MIME_QP_LONG_LINE 17569 4.46 3.50 4.90 54 BOTNET_IPINHOSTNAME 17129 7.25 12.65 4.77 55 HTML_IMAGE_RATIO_04 17002 4.80 4.94 4.74 56 RCVD_IN_MSPIKE_H4 16930 4.02 2.51 4.72 57 TR_XM_DKIM_Undo 16914 13.78 33.50 4.71 58 BAYES_40 16668 3.64 1.44 4.65 59 XM_PDF 16484 3.36 0.66 4.59 60 XMStrtUSub 16358 4.75 5.16 4.56 61 RCVD_IN_VALIDITY_CERTIFIED 16197 3.78 2.19 4.51 62 RCVD_IN_IADB_SPF 16171 3.71 1.99 4.51 63 BAYES_80 15437 5.48 8.05 4.30 64 HTML_IMAGE_RATIO_06 15339 4.11 3.74 4.28 65 RCVD_IN_IADB_SENDERID 14499 3.35 1.84 4.04 66 XM_B_SpammyWords3 14391 6.68 12.48 4.01 67 T_TooManySym_02 14211 2.95 0.75 3.96 68 TR_XM_SpammyWords4 14167 6.36 11.62 3.95 69 XMSexyCombo_05 14163 5.91 10.17 3.95 70 BAYES_999 14076 10.79 25.73 3.92 71 RCVD_IN_IADB_DK 14055 3.28 1.88 3.92 72 XM_UncommonTLD01 14032 5.69 9.56 3.91 73 RELAYCOUNTRY_META 13703 9.24 21.03 3.82 74 XMNumbers 13609 3.84 3.93 3.79 75 TR_XM_DK_SendGrid 13601 3.88 4.09 3.79 76 TR_XM_PhishingBody 13478 4.82 7.13 3.76 77 T_REMOTE_IMAGE 13290 3.22 2.18 3.70 78 XMSubMetaSx_00 13169 4.47 6.22 3.67 79 BAYES_20 12393 2.69 1.01 3.45 80 MIME_HTML_ONLY_MULTI 12169 4.26 6.15 3.39 81 RCVD_IN_IADB_VOUCHED 11785 2.57 1.02 3.28 82 FSL_BULK_SIG 11402 5.07 9.20 3.18 83 XM_B_Phish_Phrases 11248 3.96 5.75 3.14 84 DKIM_INVALID 10579 2.74 2.28 2.95 85 HTML_IMAGE_RATIO_08 9991 2.85 3.00 2.78 86 MIME_HTML_MOSTLY 9905 3.26 4.34 2.76 87 MAILING_LIST_MULTI 9811 2.47 1.90 2.73 88 BAYES_95 9800 3.29 4.49 2.73 89 FROM_EXCESS_BASE64 9647 2.57 2.32 2.69 90 URI_NOVOWEL 9146 2.51 2.44 2.55 91 XM_SPF_SoftFail 9088 3.13 4.44 2.53 92 HTML_MIME_NO_HTML_TAG 8616 3.18 4.86 2.40 93 TooManyTo_002 8053 1.73 0.60 2.24 94 XM_B_SpammyTLD 8050 2.76 3.90 2.24 95 RCVD_IN_IADB_OPTIN 7843 1.69 0.59 2.19 96 TR_XM_SB_Phish 7636 2.02 1.78 2.13 97 XMSubPhish11 7575 1.96 1.65 2.11 98 T_XMDrugObfuBody_08 7508 2.67 3.94 2.09 99 BAYES_05 7444 1.58 0.49 2.07 100 XM_GoogleGroups 7320 2.63 3.91 2.04 101 BOUNCE_MESSAGE 7311 1.61 0.68 2.04 102 ANY_BOUNCE_MESSAGE 7311 1.61 0.68 2.04 103 XM_H_Trusted_IP 6944 1.33 0.00 1.94 104 TM2_M_VERY_LONG_WORD 6879 3.22 6.07 1.92 105 INVALID_MSGID 6832 1.34 0.11 1.90 106 XM_CamelCaseFrm001 6550 2.03 2.48 1.83 107 TM2_M_URI_OPT_OUT 6422 2.10 2.76 1.79 108 XM_B_Phish66 6325 2.37 3.71 1.76 109 MSGID_NOFQDN1 6313 1.21 0.02 1.76 110 IN_HORDE_ADDRESS_BOOK 6293 1.23 0.08 1.75 111 TR_XM_SpammyRelay 6223 5.97 15.18 1.73 112 HELO_NODOT 6184 1.36 0.56 1.72 113 HELO_NO_DOMAIN 6177 1.36 0.56 1.72 114 TVD_RCVD_IP 6164 1.26 0.25 1.72 115 TR_DCC_Bayes_99 6117 8.55 23.45 1.70 116 SUBJ_ALL_CAPS 6041 1.80 2.05 1.68 117 TO_MALFORMED 6027 1.16 0.02 1.68 118 XM_B_Unsub2 5858 2.05 2.95 1.63 119 BOTNET 5848 3.88 8.79 1.63 120 XM_DK_Undo_01 5801 1.76 2.08 1.62 121 T_TooManySym_03 5740 1.16 0.21 1.60 122 XM_B_Investor 5726 2.65 4.95 1.60 123 TR_Symld_Words 5702 1.49 1.28 1.59 124 T_XMDrugObfuBody_14 5651 2.19 3.54 1.58 125 XMDiploma_00 5569 2.02 3.05 1.55 126 KHOP_HELO_FCRDNS 5497 1.57 1.65 1.53 127 UNTRUSTED_Relay 5485 3.54 7.91 1.53 128 TVD_SPACE_RATIO 5400 1.05 0.05 1.51 129 TooManyTo_003 5266 1.16 0.47 1.47 130 TR_XM_UnparsRelay 5034 2.97 6.39 1.40 131 XMBSHREFv2 4708 1.01 0.36 1.31 132 TR_XM_SpammyWords5 4513 2.15 4.09 1.26 133 XM_H_Long_From02 4469 1.24 1.24 1.25 134 XMLngstWrd_00 4435 2.01 3.69 1.24 135 XMStockSpam_06 4425 1.36 1.65 1.23 136 T_FILL_THIS_FORM_SHORT 4357 2.04 3.84 1.21 137 URI_HEX 4251 1.37 1.76 1.18 138 XMCapTrack 4218 0.92 0.37 1.18 139 XMLngstWrd_01 4172 1.94 3.64 1.16 140 XMGappySubj_01 4161 0.87 0.23 1.16 141 TR_XM_Base64_M1 4033 1.12 1.10 1.12 142 XM_OfRef6 3960 1.95 3.81 1.10 143 HTML_FONT_FACE_BAD 3874 0.93 0.60 1.08 144 TooManyTo_004 3830 0.86 0.41 1.07 145 XMLngstWrd_02 3780 1.85 3.57 1.05 146 RCVD_IN_MSPIKE_H5 3697 0.76 0.17 1.03 147 XMPhish30 3664 1.05 1.11 1.02 148 XM_UB50 3660 1.84 3.63 1.02 149 RCVD_IN_RP_SAFE 3547 0.87 0.60 0.99 150 XMBody_95 3471 0.76 0.30 0.97 151 TR_XM_SpammyWords2 3438 4.33 11.67 0.96 152 XMLngstWrd_03 3437 1.75 3.48 0.96 153 XM_B_COPY_HTML 3401 0.87 0.71 0.95 154 XMBrknScrpt_02 3388 1.11 1.46 0.94 155 XMSubNoVowel 3361 0.79 0.46 0.94 156 HTTPS_HTTP_MISMATCH 3351 0.96 1.03 0.93 157 RELAYCOUNTRY_CA 3295 3.43 8.91 0.92 158 DKIM_ADSP_CUSTOM_MED 3239 0.83 0.66 0.90 159 RCVD_IN_RP_CERTIFIED 3223 0.77 0.48 0.90 160 XMLngstWrd_04 3175 1.67 3.39 0.88 161 TooManyTo_005 3038 0.70 0.38 0.85 162 FVGT_m_MULTI_ODD_EMAIL 3003 0.62 0.14 0.84 163 XM_B_SpammyWords4 2972 1.44 2.77 0.83 164 SpammyFromTLD_01 2971 1.33 2.42 0.83 165 XMHTML_After_End 2940 1.04 1.53 0.82 166 FROM_GOV_DKIM_AU 2905 0.62 0.22 0.81 167 XMGenDplmaNmb 2521 0.99 1.63 0.70 168 XMBdyGiftCard01 2496 0.95 1.49 0.70 169 HTML_TITLE_SUBJ_DIFF 2494 1.52 3.33 0.70 170 UPPERCASE_75_100 2471 1.50 3.26 0.69 171 XM_H_PHPMailer 2454 0.71 0.78 0.68 172 HTML_TAG_BALANCE_BODY 2451 0.96 1.57 0.68 173 TR_MetaPhish_Combo_01 2451 0.68 0.66 0.68 174 T_XMDrugObfuBody_00 2405 0.95 1.56 0.67 175 XMSubMetaI_00 2391 0.71 0.79 0.67 176 XM_RXBody 2315 0.61 0.53 0.65 177 RCVD_IN_MSPIKE_BL 2297 1.41 3.08 0.64 178 XM_ShortIntro_01 2277 0.60 0.51 0.63 179 T_OBFU_PDF_ATTACH 2268 0.47 0.13 0.63 180 TR_XM_MSPIKECOMBO 2242 1.39 3.05 0.62 181 XMPhish14 2232 0.88 1.46 0.62 182 XMSexyCombo_01 2192 1.01 1.89 0.61 183 URI_TRY_3LD 2125 0.75 1.09 0.59 184 NML_ADSP_CUSTOM_MED 2102 0.56 0.50 0.59 185 XMHTMLBadTable_001 2094 0.65 0.79 0.58 186 RCVD_IN_MSPIKE_L3 2010 1.14 2.40 0.56 187 XM_ProductURIs 1932 0.69 1.03 0.54 188 XMNoVowels 1931 0.50 0.41 0.54 189 RELAYCOUNTRY_GB 1876 0.54 0.59 0.52 190 HTML_IMAGE_ONLY_20 1874 0.45 0.30 0.52 191 SHORT_HELO_AND_INLINE_IMAGE 1872 0.38 0.06 0.52 192 TO_NO_BRKTS_HTML_ONLY 1845 0.39 0.10 0.51 193 XMBody_17 1838 1.50 3.64 0.51 194 MPART_ALT_DIFF_COUNT 1823 0.70 1.10 0.51 195 XMMoneyMeta_00 1799 0.66 1.01 0.50 196 FORGED_GMAIL_RCVD 1799 0.51 0.54 0.50 197 HTML_IMAGE_ONLY_32 1723 0.41 0.27 0.48 198 TR_XM_Spammywords 1685 0.56 0.75 0.47 199 XM_S_SpammyWords 1685 0.56 0.75 0.47 200 TM2_M_BODY_EMPTY 1679 0.35 0.08 0.47 ----------------------------------------------------------------------